# scan-redactor

This Claude Security subagent replaces secret values in completed scan reports with [REDACTED]. Scan jobs dispatch it automatically; it is not for direct invocation.

- subagent · `type=agent` · Claude Code · ★ 44635
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-redactor.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/scan-redactor

## What it does

\`scan-redactor` checks the three files produced by a completed Claude Security scan: `CLAUDE-SECURITY-RESULTS.jsonl`, `CLAUDE-SECURITY-RESULTS.sarif` and `CLAUDE-SECURITY-RESULTS.md`. It replaces password, key, token and other secret values with `[REDACTED]`. Variable names and placeholders such as `${API_KEY}` stay unchanged.

The subagent uses `Read` and `Edit` to inspect and change the reports. Long files are read in pieces, and all three files are checked. It avoids JSON keys and the `file`, `uri` and `symbol` fields, and it creates no files. Check that the scan job supplied the expected three files from one directory: a different set of paths means it makes no edits. Direct invocation is not supported.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/scan-redactor.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/scan-redactor.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/scan-redactor.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-redactor.md

## When to use it
- redact secrets in a security scan report
- remove key and token values from JSONL and SARIF files
- mask a password in a URL or user:password pair
- check all report files for remaining secret values

## Example prompts
- Run Claude Security and redact secrets in the resulting report files.
- After the scan, replace password and key values with `[REDACTED]`.
- Check the Claude Security reports and report any file that could not be cleaned.

## Similar
- [security-diff-scan](https://affpapa.org/en/nevibecode/skills/security-diff-scan.md) — skill · 30 installs
- [codeql](https://affpapa.org/en/nevibecode/skills/codeql.md) — skill · 2000 installs
- [triage-finding](https://affpapa.org/en/nevibecode/skills/triage-finding.md) — skill · 30 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 123 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md